China-Nexus Hackers Target Linux Devices to Redirect Traffic and Deploy Malware

**Executive Summary:** DKnife is an advanced adversary-in-the-middle (AitM) framework that compromises Linux-based routers and edge devices to perform deep packet inspection and hijack legitimate software updates—redirecting Android APK and Windows downloads to attacker-controlled binaries and deploying backdoors such as ShadowPad and DarkNimbus; it comprises seven ELF components (e.g., dknife.bin, yitiji.bin, postapi.bin) that create a virtual local network, exfiltrate credentials, and remain active as of January 2026, with evidence linking its infrastructure to WizardNet/Spellbinder and with a focus on Chinese services and users.